Description
A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. 

This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. 
Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.
Published: 2026-01-21
Score: 8.2 High
EPSS: 4.1% Low
KEV: Yes
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in Cisco Unified Communications Manager and related products allows an attacker to send crafted HTTP requests to the web management interface. The flaw arises from improper validation of user-supplied input, enabling arbitrary command execution on the underlying operating system. A successful exploit can yield user-level access and privilege escalation to root, compromising confidentiality, integrity, and availability.

Affected Systems

Cisco Unified Communications Manager (including Unified CM Session Management Edition and IM & Presence Service), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance. Specific affected versions are not listed in the advisory; any installed instance of these products is potentially vulnerable.

Risk and Exploitability

The CVSS base score of 8.2 indicates high severity, while an EPSS score of 4% reflects a low but non-zero likelihood of exploitation. Listed in the CISA KEV catalog, the vulnerability has been demonstrated or exploited. Attackers can remotely, unauthenticated, exploit the web interface by sending crafted requests, leading to arbitrary code execution and privilege escalation.

Generated by OpenCVE AI on April 21, 2026 at 23:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Cisco security update released for Unified Communications Manager, Unified CM SME, Unified CM IM & Presence Service, Unity Connection, and Webex Calling Dedicated Instance.
  • Restrict access to the web-based management interface to trusted networks, using firewalls or VPNs to reduce exposure.
  • Review system logs for suspicious access attempts and update firewall rules to block known malicious request patterns targeting the vulnerable endpoint.

Generated by OpenCVE AI on April 21, 2026 at 23:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 13 Feb 2026 21:00:00 +0000

Type Values Removed Values Added
Description A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.  This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.  This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.  Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.

Fri, 23 Jan 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Cisco webex
Vendors & Products Cisco webex

Thu, 22 Jan 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Cisco
Cisco unified Communications Manager
Cisco unified Communications Manager Im And Presence Service
Cisco unity Connection
CPEs cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*
cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*
cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*
Vendors & Products Cisco
Cisco unified Communications Manager
Cisco unified Communications Manager Im And Presence Service
Cisco unity Connection

Wed, 21 Jan 2026 21:15:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 kev

{'dateAdded': '2026-01-21T00:00:00+00:00', 'dueDate': '2026-02-11T00:00:00+00:00'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Jan 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Jan 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Jan 2026 16:45:00 +0000

Type Values Removed Values Added
Description A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.  This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.
Title Cisco Unified Communications Products Remote Code Execution Vulnerability
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Cisco Unified Communications Manager Unified Communications Manager Im And Presence Service Unity Connection Webex
cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-02-26T14:44:34.950Z

Reserved: 2025-10-08T11:59:15.354Z

Link: CVE-2026-20045

cve-icon Vulnrichment

Updated: 2026-01-21T16:44:10.574Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-21T17:16:08.077

Modified: 2026-02-13T21:37:06.717

Link: CVE-2026-20045

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T00:00:03Z

Weaknesses